Skip to content

fix: default missing sub-agent trust_level to untrusted and gate delegate_tasks (M-6)#63

Merged
jkyberneees merged 1 commit into
mainfrom
fix/m6-subagent-trust-defaults
Jul 18, 2026
Merged

fix: default missing sub-agent trust_level to untrusted and gate delegate_tasks (M-6)#63
jkyberneees merged 1 commit into
mainfrom
fix/m6-subagent-trust-defaults

Conversation

@jkyberneees

Copy link
Copy Markdown
Contributor

Closes the self-attested trust_level bypass for delegate_tasks (M-6).

Changes:

  • cmd/odek/subagent.go: applySubagentTrust now treats an empty trust_level as untrusted.
  • internal/loop/loop.go: classifyToolCall classifies delegate_tasks as system_write.
  • Updated/added regression tests in cmd/odek/subagent_trust_test.go and internal/loop/loop_test.go.
  • Updated docs/SECURITY.md and AGENTS.md.

@jkyberneees
jkyberneees merged commit 071dd36 into main Jul 18, 2026
1 check was pending
@jkyberneees
jkyberneees deleted the fix/m6-subagent-trust-defaults branch July 18, 2026 13:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant